Dependency-confusion beacon malware: wiseke npm packages (@greenlake, @sxm-web, @drone-js-ext, @ppa-web-components) — postinstall exfiltrates hostname/paths to 185.158.107.175
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
On 2026-10-26 GitHub advisories (GHSA-pfqf-544g-rvp9 and others) flagged 14 dependency-confusion packages published by npm user wiseke under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 and 2026-10-25. Each package poses as a 'compatibility shim' for an 'authorized dependency-confusion test', uses inflated version numbers to win resolution, and runs beacon.cjs via a postinstall script (also on import). It POSTs hostname, install path and cwd over plain HTTP to http://185.158.107.175:8787/ah/dc, while exporting a no-op Proxy so builds keep running. index.js is byte-identical to ph-common (MAL-2026-1809). No patched versions exist; affected orgs are those whose internal scope names match these packages.
What to do
- Audit lockfiles and CI logs for any @greenlake/*, @sxm-web/*, @drone-js-ext/* or @ppa-web-components/* installs since 2026-10-23 and remove/quarantine them
- Check egress and proxy logs for connections to 185.158.107.175:8787 (path /_ah/dc) and treat hits as confirmed compromise of the build host
- Rebuild affected projects from clean caches and rotate any secrets accessible to CI runners on those hosts
- Block the C2 IP at the firewall and disable install scripts (npm config set ignore-scripts true) in CI
- Register/claim these internal scopes on npm and enable dependency-confusion protections
Sources
All live incidents on Threat Watch
